aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorandroid-build-team Robot <android-build-team-robot@google.com>2019-03-13 20:14:48 +0000
committerandroid-build-team Robot <android-build-team-robot@google.com>2019-03-13 20:14:48 +0000
commite2a887d270fdbb2cecccca6542c380fa56059667 (patch)
tree9f72f8d993b7d6ffef411f9bbf1aff28553dcdab
parent8bb10d724c4ecb822c16826ba20b9669bfd212a6 (diff)
parent0bcc99c696a1352aa9de5280d2c84fe6cbb1c40c (diff)
downloadwpa_supplicant_8-oreo-m8-release.tar.gz
Merge cherrypicks of [6714499, 6716593, 6716594, 6716595, 6716596, 6716597, 6716977, 6718226, 6717773, 6716978, 6717663] into oc-m8-releaseandroid-8.1.0_r67android-8.1.0_r65android-8.1.0_r64oreo-m8-release
Change-Id: I65116afc607270ed116a40dc51259a1dc383c47f
-rw-r--r--wpa_supplicant/wnm_sta.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/wpa_supplicant/wnm_sta.c b/wpa_supplicant/wnm_sta.c
index bd0b5172..05b9f6c2 100644
--- a/wpa_supplicant/wnm_sta.c
+++ b/wpa_supplicant/wnm_sta.c
@@ -373,6 +373,10 @@ static void wnm_parse_neighbor_report_elem(struct neighbor_report *rep,
rep->preference_present = 1;
break;
case WNM_NEIGHBOR_BSS_TERMINATION_DURATION:
+ if (elen < 10) {
+ wpa_printf(MSG_DEBUG, "WNM: Too short bss_term_tsf");
+ break;
+ }
rep->bss_term_tsf = WPA_GET_LE64(pos);
rep->bss_term_dur = WPA_GET_LE16(pos + 8);
rep->bss_term_present = 1;